--- title: "45 CFR 160.203 HIPAA: General rule and exceptions" canonical: "https://dposchool.com/hipaa/section/160.203" source: "https://www.ecfr.gov/current/title-45/section-160.203" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 160.203 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart B: Preemption of State Law # 45 CFR 160.203 HIPAA: General rule and exceptions eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text A standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law. This general rule applies, except if one or more of the following conditions is met: ### 45 CFR 160.203(a) **(a)** A determination is made by the Secretary under § 160.204 that the provision of State law: #### 45 CFR 160.203(a)(1) **(1)** Is necessary: ##### 45 CFR 160.203(a)(1)(i) **(i)** To prevent fraud and abuse related to the provision of or payment for health care; ##### 45 CFR 160.203(a)(1)(ii) **(ii)** To ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation; ##### 45 CFR 160.203(a)(1)(iii) **(iii)** For State reporting on health care delivery or costs; or ##### 45 CFR 160.203(a)(1)(iv) **(iv)** For purposes of serving a compelling need related to public health, safety, or welfare, and, if a standard, requirement, or implementation specification under part 164 of this subchapter is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or #### 45 CFR 160.203(a)(2) **(2)** Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law. ### 45 CFR 160.203(b) **(b)** The provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter. ### 45 CFR 160.203(c) **(c)** The provision of State law, including State procedures established under such law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention. ### 45 CFR 160.203(d) **(d)** The provision of State law requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities or individuals. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[65 FR 82798, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002\] [45 CFR 160.203 on eCFR](https://www.ecfr.gov/current/title-45/section-160.203) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 160.203 Previous: [45 CFR 160.202 HIPAA: Definitions](https://dposchool.com/hipaa/section/160.202) Next: [45 CFR 160.204 HIPAA: Process for requesting exception determinations](https://dposchool.com/hipaa/section/160.204) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents